Data escrow & durability plan

A plain-language explanation of how we keep your Permanent Record safe — and what happens to it if HomeschoolOS ever goes away.

_This page describes operational commitments, not a legal contract. It is not legal advice. The words we use here are intended to be clear and honest; the exact mechanics will be finalized with our escrow trustee once that relationship is in place._

What this is

Data escrow is a simple idea: a second party holds the keys to your records so that even if the original company disappears, your records don't. For HomeschoolOS specifically, "escrow" means a combination of three things — a backup you already hold, a public read-only mirror, and a named trustee who can release the underlying storage if we are no longer around to run the service.

Our commitment

If the company behind HomeschoolOS becomes unable to operate — whether through shutdown, insolvency, or acquisition without a continuation plan — we commit to the following wind-down sequence:

1. A final full export, emailed to every family at the registered parent email on file, with a download link valid for at least 90 days. This uses the same export pipeline you can trigger today from Settings → Family → Export my data.
2. A public read-only mirror of each family's sealed school years, published at a pre-agreed static URL for at least 90 days, so you can open and read your record in a browser without needing an account.
3. Release to a named escrow trustee. The underlying Supabase database and Cloudflare R2 mirror bucket are turned over to a named trustee with explicit instructions to make every family's sealed data retrievable for as long as is practically possible.

What is already built today:

• The export pipeline in Settings → Family (item 1 above).
• The Supabase-plus-Cloudflare-R2 dual-storage mirror (see "Today's mirrors" below).
• The weekly durability audit that re-hashes every sealed year.

What is aspirational:

• The static read-only mirror URL (item 2).
• A named, contracted escrow trustee (item 3). We'll publish the trustee's name and contract summary on this page once the relationship is signed.

Today's mirrors

Every sealed school year is written to two independent providers on two different clouds:

• Primary storage: Supabase Postgres + Storage. The live database and object store that the app runs against.
• Cold mirror: Cloudflare R2. A second copy of every sealed year's certified packet and manifest, written at year-close.

A scheduled audit walks every mirrored year each week and re-hashes the files. If the stored hash no longer matches what we originally wrote, the row is flagged and surfaced on the Trust & durability page inside each parent's dashboard.

No family-identifying information is included in these aggregate numbers — every mirror row is private to the family it belongs to, and mirror pointers are protected by the same row-level security policies that govern the rest of your record.

Your rights

Regardless of the above, the following are always available to you:

• Export my data. The export flow in Settings → Family produces a downloadable archive of your family's records at any time.
• Delete my data. The Danger zone card in Settings → Family permanently deletes your account and all associated records.
• Read-only access, free forever. Your Permanent Record stays open to you even after a subscription lapses — see the Trust & durability page inside the dashboard for the per-year durability status of your archive.
• Privacy. The full privacy policy explains what we collect, why we collect it, and who can see it.

If you have questions about this plan, reply to any HomeschoolOS email or contact support from inside the app — we read every message.